Pin GitHub Actions to commit SHA hashes with version comments

[lpmi-13]

Both dependabot and renovate now speak SHA natively, so there's no reason not to do this. And it isolates the workflows from a malicious actor pushing an update overwriting an existing version tag (not super likely with a github-owned action, but no harm in defense in depth)

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Improved deployment workflow security by pinning third-party automation steps to immutable versions.
  • Preserved compatibility with existing deployment behavior.

Walkthrough

The deployment workflow now pins the checkout, Node setup, Pages artifact upload, and Pages deployment actions to immutable commit SHAs. Comments retain the previous major-version references.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes pinning GitHub Actions to commit SHA hashes and retaining version comments.
Description check	✅ Passed	The description explains the security benefit of SHA pinning and its support in Dependabot and Renovate.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy.yml:
- Line 18: Update the actions/checkout step in the deploy workflow to set
persist-credentials to false, ensuring checkout credentials are not retained for
subsequent dependency installation and build steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6875798-6f57-4f93-8877-84ded37695e2

📥 Commits

Reviewing files that changed from the base of the PR and between d647718 and 925d000.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

workflow=".github/workflows/deploy.yml"
rg -n -C 3 'actions/checkout|persist-credentials|(^|[[:space:]])git([[:space:]]|$)' "$workflow"

Repository: bufferapp/smart-tag

Length of output: 404

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

workflow=".github/workflows/deploy.yml"
echo '--- workflow excerpt ---'
sed -n '1,140p' "$workflow" | nl -ba

echo
echo '--- checkout references in workflows ---'
git ls-files '.github/workflows/*' | xargs -r rg -n -C 2 'actions/checkout|persist-credentials|git ' || true

Repository: bufferapp/smart-tag

Length of output: 222

---

🌐 Web query:

actions/checkout v6 persist-credentials default true documentation

💡 Result:

In actions/checkout v6, the persist-credentials input defaults to true [1]. When enabled (the default), the action configures the Git repository with the provided token or SSH key, allowing subsequent steps in your workflow to execute authenticated Git commands (such as git fetch or git push) automatically [2][3]. While the default remains true, v6 introduced an improvement to credential security: instead of storing these credentials directly in the.git/config file, they are now stored in a separate file under the $RUNNER_TEMP directory [2][4]. This change helps prevent the token from accidentally leaking (for example, through artifact publishing) while maintaining functionality [5]. The token is still removed during post-job cleanup [2][6]. To disable this behavior, you can explicitly set the input to false in your workflow file [2][3]: - uses: actions/checkout@v6 with: persist-credentials: false

Citations:

• 1: https://raw.githubusercontent.com/actions/checkout/v6/action.yml
• 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
• 3: https://github.com/actions/checkout/?tab=readme-ov-file
• 4: https://github.com/actions/checkout/tree/v6.0.0
• 5: [security] Escalate concerning default persist-credentials=true please actions/checkout#2312
• 6: https://github.com/actions/checkout

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

workflow=".github/workflows/deploy.yml"
echo '--- workflow excerpt ---'
sed -n '1,140p' "$workflow" | sed -n '='

echo
echo '--- line-number excerpt with cat ---'
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/deploy.yml")
for i, line in enumerate(p.read_text().splitlines(), 1):
    if i <= 140:
        print(f"{i:4}: {line}")
PY

echo
echo '--- checkout references in workflows ---'
git ls-files '.github/workflows/*' | while read -r f; do
  rg -n -C 2 'actions/checkout|persist-credentials|git ' "$f" || true
done

Repository: bufferapp/smart-tag

Length of output: 1804

---

Disable checkout credential persistence.

actions/checkout preserves credentials by default, but this job never runs authenticated Git commands after checkout. Add persist-credentials: false so dependency installation and build steps do not retain unnecessary credentials.

Proposed fix

       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
	with:
	persist-credentials: false

🧰 Tools

🪛 zizmor (1.28.0)

[warning] 18-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy.yml at line 18, Update the actions/checkout step in
the deploy workflow to set persist-credentials to false, ensuring checkout
credentials are not retained for subsequent dependency installation and build
steps.

Source: Linters/SAST tools

[lpmi-13]

By the way, I would happily also upgrade the actions (eg, checkout's latest version is v7 now), but I explicitly didn't do that here to preserve existing functionality.